Malware in npm packages.

LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.

Packages — page 6

513 packages with LPM's own review, newest scan first. Showing 241–288.

Sep 4, 2026

taskforge-9xv@1.3.0

Malware

OpenSSF Malicious Packages via OSV confirms taskforge-9xv@1.3.0 as malicious (MAL-2026-15914): Malicious code in taskforge-9xv (npm)

Sep 4, 2026

comein-player-web@0.1.0

Malware

The UMD entrypoint is intentionally obfuscated and dynamically evaluates generated code. This is concrete opaque runtime execution in the package's normal import path.

Sep 4, 2026

bnotify-web-sdk@1.1.9

Malware

OpenSSF Malicious Packages via OSV confirms bnotify-web-sdk@1.1.9 as malicious (MAL-2026-14551): Malicious code in bnotify-web-sdk (npm)

Sep 4, 2026

kisama-js@0.4.8

Malware